For End-of-Life Equipment, a NAID Provider is What You Need
Will your company upgrade any of its computers this year? If so, you will have hard drives on your hands requiring secure retirement. Destruction is the only truly secure way to retire data, so tracking down a destruction contractor will be your first step. But you need to know more than whether or not they do their job properly. You also need to know if they do so securely.
Who are the most secure data destruction companies, and where can you find them?
One reliable place to start is the NAID website (www.naidonline.com). NAID (National Association for Information Destruction) is the recognized international trade association for companies providing data destruction services, serving the U.S., Australasia, Europe and Canada.
Not just a trade organization
NAID asks much more than fees for membership. Its requirements call for a systemic approach to establishing data security on the part of its member organizations. All aspects of data handling are covered, from pickup and delivery to the moment of destruction, all the way down to disposal.
To join NAID, a comprehensive audit must be taken by a Certified Protection Professional (CPP) auditor, designated through ASIS International, another international security standard-bearer. ASIS provides training and education for security professionals around the world. Its auditors are considered the most reliably prepared for the job.
In the qualification process, NAID’s CPP auditor performs an on-site evaluation of the member candidate’s business location, examining all aspects of data destruction that may lead to accidental exposure, such as transportation, storage, destruction, and final disposal. Two kinds of certification are considered—plant-based (for destruction on-site at the contractor’s facility) and mobile (for truck units performing destruction services at customer locations). Some examples of what NAID requires for membership include:
-Assurance that all media for destruction will be either attended by an employee OR physically secured from unauthorized access while in the custody of the destruction contractor
-Signed confidentiality agreements from all employees and contractors prior to accessing “Confidential Customer Media,” such as paper documents, hard drives and CDs/DVDs
-Drug testing for employees, or drug abuse awareness training for the employer, and seven-year criminal background checks for all employees—ongoing criminal checks, too
-Closed-caption video and adequate lighting for surveillance; tapes must be kept on the premises for 90 days
-Required customer notification in case of potential release of sensitive data that may threaten the security of confidentiality of that data
-For mobile certification, all destruction must be performed at the customer’s site. For plant-based destruction, unauthorized access to the designated secure destruction area and client records must be effectively prevented.
This list was taken from the extensive inventory of procedures and checks to ensure conscientious and thorough data protection—and there are many more. This brief sampling shows that NAID-certified businesses—such as RenovoData Services in Edina, Minn.—create secure environments to give their customers the highest recognized standard of protection around data destruction.
Without NAID’s researched and thoughtfully designed system of protections in place, the risk of data breach can increase in the process of destruction. Data loss has been widely documented in recent years as a significant risk to sensitive customer information as well as important corporate data. These breaches always result in costly cleanup efforts and loss of reputation for the victim companies.
Since no other standard exists that provides NAID’s level of protection during destruction, checking for certification should come first as you research data destruction providers in your area. Simply put, it is the best thing you can do for your customers, and for your company’s bottom line.
